bitwarden/server · error · BadRequestException

User email does not match invite.

Error message

User email does not match invite.

What it means

Thrown inside AcceptUserAsync when the logged-in user's email does not match the ProviderUser.Email recorded on the invite (case-insensitive comparison). This prevents accepting an invite intended for a different account. BadRequestException (HTTP 400).

Source

Thrown at bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:267

        {
            throw new BadRequestException("User invalid.");
        }

        if (providerUser.Status != ProviderUserStatusType.Invited)
        {
            throw new BadRequestException("Already accepted.");
        }

        if (!CoreHelpers.TokenIsValid("ProviderUserInvite", _dataProtector, token, user.Email, providerUser.Id,
            _globalSettings.OrganizationInviteExpirationHours))
        {
            throw new BadRequestException("Invalid token.");
        }

        if (string.IsNullOrWhiteSpace(providerUser.Email) ||
            !providerUser.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))
        {
            throw new BadRequestException("User email does not match invite.");
        }

        var organizationAutoConfirmPolicyRequirement = await _policyRequirementQuery
            .GetAsync<AutomaticUserConfirmationPolicyRequirement>(user.Id);

        if (organizationAutoConfirmPolicyRequirement
            .CannotJoinProvider())
        {
            throw new BadRequestException(new UserCannotJoinProvider().Message);
        }

        providerUser.Status = ProviderUserStatusType.Accepted;
        providerUser.UserId = user.Id;
        providerUser.Email = null;

        await _providerUserRepository.ReplaceAsync(providerUser);

        return providerUser;

View on GitHub (pinned to e93b962371)

Solutions

1. Log in with the exact email the invite was sent to.
2. Have the admin resend the invite to the user's current email.
3. Trim/normalize email input when generating invites.

if (string.IsNullOrWhiteSpace(providerUser.Email) ||
    !providerUser.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))
    throw new InvalidOperationException("Logged-in email does not match the invite recipient.");

try { await _providerService.AcceptUserAsync(providerUserId, user, token); }
catch (BadRequestException ex) when (ex.Message.Contains("email does not match"))
{ /* instruct user to log in with the invited email */ }

When it happens

Trigger: Logged in as user A but the invite email is for user B; whitespace/alias differences in the stored email.

Common situations: Wrong account logged in; email alias (+tag) differences; email changed on the account after the invite was sent.

Related errors

• Invalid token.
• Invalid permissions.
• User invalid.
• Already accepted.
• Invalid owner. Owner must be an existing Bitwarden user.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/9128b6053baecc7f. Report an issue: GitHub.